Nigerian banks and fintech companies are asking for more time to comply with the Central Bank of Nigeria's requirement that payment transaction data generated in the country be stored and managed in Nigeria.
The rule takes full effect on 1 January 2027. Industry executives say the policy direction is understandable but warn that the migration window may be too short for some institutions to move critical workloads safely.
What the CBN requires
The directive applies broadly to banks, fintechs, mobile-money operators, switching and processing companies, payment service providers and other licensed participants facilitating payments in Nigeria.
It requires payment transaction data generated in Nigeria to be stored and managed within the country in line with applicable data-protection requirements.
Why banks and fintechs want more time
Executives cited the complexity of moving large workloads from overseas cloud environments, the need to preserve resilience and disaster recovery, cybersecurity risks and unanswered questions around hybrid-cloud architectures.
A rushed migration could create operational risk if institutions move systems before redundancy, connectivity, failover and security controls are fully tested.
Data localisation is more than copying files
Payment systems depend on databases, APIs, fraud controls, backups, network links and disaster-recovery environments. Moving the primary data store without redesigning these dependencies can create new failure points.
Has the deadline been extended?
No extension has been announced in the reporting reviewed for this article. The current deadline remains 1 January 2027. The industry request for more time should not be interpreted as a change in CBN policy.
What institutions should do now
Financial institutions should map which payment data falls within scope, review cloud and outsourcing contracts, test local infrastructure capacity, validate disaster recovery and engage the regulator early on areas where the technical interpretation is unclear.
Bottom line
Nigeria's payment-data localisation programme is becoming an infrastructure and operational-resilience test, not just a compliance exercise. The debate is increasingly about how to meet the localisation goal without introducing new risks into a payments system that must remain continuously available.
